feat: implement issue #896 — triage skill: add a risk-severity rubric to prompts/triage.md (model systematically under-rates risk)

[don-petry]

Closes #896

Implemented by dev-lead agent. Please review.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[coderabbitai]

Warning

Review limit reached

@don-petry, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 30 minutes and 54 seconds. Learn how PR review limits work.

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file).

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.

🚦 How do rate limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan refill rate.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, the refill rate gradually slows as usage increases. The highest same-day bursts are limited more strictly.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 33c96e64-f443-4695-b9de-ff1d4348efa4

📥 Commits

Reviewing files that changed from the base of the PR and between 1dc9b5e and 9751d51.

📒 Files selected for processing (3)

• .github/workflows/lint.yml
• prompts/triage.md
• tests/test_triage_prompt.bats

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dev-lead/issue-896-20260621-2300

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[gemini-code-assist]

Code Review

This pull request adds a new Risk rating section to the triage prompt (prompts/triage.md) to define HIGH, MEDIUM, and LOW risk bands, and introduces a BATS test suite (tests/test_triage_prompt.bats) to structurally validate these changes. The review feedback identifies two minor issues in the test assertions where the regex patterns ('incomplete context' and 'docs') do not correctly match the actual text in the prompt file, and provides suggestions to fix them.

[don-petry]

Dev-Lead — review-changes (applied)

Changes committed and pushed.

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[donpetry-bot]

Advisory bots were rate-limited; auto-approval is withheld until they recover. pr-review-sweep will re-review this PR after 2026-06-22T00:38:34Z.

[don-petry]

Dev-Lead — fix-bot-comment (no-changes)

Agent reasoning

Issues addressed: 0
Files changed: prompts/triage.md, tests/test_triage_prompt.bats, .github/workflows/lint.yml
Status: Quality Gate Passed — no action required
```

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[donpetry-bot]

Automated review — APPROVED ✓

Risk: LOW
Reviewed commit: 9751d5151761b7294f04163d243406b98c85f693
Review mode: triage-approved (single reviewer)

Summary

Additive fix for #896: adds a ## Risk rating section to prompts/triage.md encoding the issue's HIGH/MEDIUM/LOW rubric, a new structural bats test (tests/test_triage_prompt.bats) guarding the section against silent removal, and one line wiring that test into the lint workflow. Escalate criteria (1-7) and the output schema are left untouched.

Linked issue analysis

Closes #896. The issue asked for a single additive ## Risk rating section anchored to the existing escalate criteria, with no changes to criteria 1-7 or the output schema. The diff delivers exactly that: the rubric bands match the issue's proposed table, and a test explicitly asserts ## Decision criteria and "escalate": true remain intact. The 5/5 held-out eval acceptance item is a separate workflow_dispatch run, out of scope for the code diff.

Findings

No blocking findings. Gemini's earlier two comments (regex patterns for 'incomplete context' and 'docs') were against the first commit; the current test assertions (incomplete.*context, doc|comment|formatting|test-only) match the current prompt text, and the bats CI job is green at the head SHA, confirming resolution. CodeRabbit approved at the head SHA. Secret-scanning MCP tool not available in this environment; relied on the gitleaks CI check (green). No security-sensitive logic: the lint.yml change only appends a test file to the bats run list (no secrets, no pull_request_target).

CI status

All checks green at head SHA 9751d51 — Lint/bats/shellcheck/gh-aw-compile/validate-agent-profiles, CodeQL (actions+python), SonarCloud, gitleaks secret scan, AgentShield, unit-tests, and guards all SUCCESS; dependency-audit sub-jobs and dependabot SKIPPED (expected). mergeStateStatus is BLOCKED only on the required org-leads human review.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.